feat: SAS-R0 signature-feature attestation - not-ready means very-early panic

- SAS-E01: scheduler bootstrap failure was "non-fatal" -> panic (O(1)
  scheduler must stand up or nothing runs)
- PCKC-E01: boot-time key-derive roundtrip in utsm_init (get_or_derive
  probe segment, all-zero key or error -> panic; probe slot invalidated)
- DKM-E04..E07: manifest required-driver failures (module missing /
  ELF invalid / symbol scan fail / load fail) -> panic instead of
  "abort stage" silent continue
- QEMU verify: pckc derive roundtrip ok, sealed MAC established,
  selftest OK, boot reaches wizard, zero spurious panics

[STUB] P0/UTSM SAS-R0 attestation | 剩余STUB命中=101（违规=0） | “特色不是招牌，是性命” | 已提交=<this>

CODE/UTSM/core/utsm_init.c

@@ -1,7 +1,9 @@
 #include <utsm/utsm.h>
 #include <utsm/segment.h>
 #include <utsm/pckc.h>
+#include <utsm/crypto.h>
 #include <utsm/process.h>
+#include <utsm/panic.h>
 #include <utsm/log.h>
 #include <utsm/config.h>
 
@@ -23,6 +25,26 @@ void utsm_init(void) {
     utsm_pckc_init();
     log_info("[UTSM] pckc init ok");
 
+    /* SAS-R0 特色自证：PCKC 启动期 key 派生往返。派生失败或密钥全零
+     * = Per-CPU 密钥缓存没有真正立起来，零降级 panic（PCKC-E01）。 */
+    {
+        utsm_segment_desc probe;
+        for (u32 i = 0; i < sizeof(probe); i++) ((u8 *)&probe)[i] = 0;
+        probe.key_epoch = 1;
+        utsm_key_material km;
+        for (u32 i = 0; i < 4; i++) km.words[i] = 0;
+        if (utsm_pckc_get_or_derive(0xFFFFFFFFu, &probe, &km) != UTSM_OK) {
+            panic_full("PCKC-E01 KEY DERIVE FAILED",
+                       "PCKC boot-time get_or_derive returned error", 0);
+        }
+        if (km.words[0] == 0 && km.words[1] == 0 && km.words[2] == 0 && km.words[3] == 0) {
+            panic_full("PCKC-E01 KEY DERIVE FAILED",
+                       "PCKC boot-time derive produced all-zero key material", 0);
+        }
+        utsm_pckc_invalidate_slot(0xFFFFFFFFu);   /* 探针段作废，不留缓存 */
+        log_info("[UTSM] pckc derive roundtrip ok");
+    }
+
     utsm_process_init();
 }
 

CODE/UTSM/core/utsm_init.d

@@ -0,0 +1,26 @@
+core/utsm_init.o: core\utsm_init.c include\utsm\utsm.h \
+  include\utsm\types.h include\utsm\status.h include\utsm\config.h \
+  include\utsm\uuid.h include\utsm\process.h include\utsm\capability.h \
+  include\utsm\segment.h include\utsm\dirty.h include\utsm\utrw.h \
+  include\utsm\vmm.h include\utsm\linux_loader.h include\utsm\ipc_shm.h \
+  ..\utsm-ipc\ipc_proto.h include\utsm\hypercall.h include\utsm\pckc.h \
+  include\utsm\crypto.h include\utsm\panic.h include\utsm\log.h
+include\utsm\utsm.h:
+include\utsm\types.h:
+include\utsm\status.h:
+include\utsm\config.h:
+include\utsm\uuid.h:
+include\utsm\process.h:
+include\utsm\capability.h:
+include\utsm\segment.h:
+include\utsm\dirty.h:
+include\utsm\utrw.h:
+include\utsm\vmm.h:
+include\utsm\linux_loader.h:
+include\utsm\ipc_shm.h:
+..\utsm-ipc\ipc_proto.h:
+include\utsm\hypercall.h:
+include\utsm\pckc.h:
+include\utsm\crypto.h:
+include\utsm\panic.h:
+include\utsm\log.h:

CODE/UTSM/dkm/manifest.c

@@ -1,5 +1,6 @@
 #include <utsm/dkm.h>
 #include <utsm/log.h>
+#include <utsm/panic.h>
 #include <utsm/types.h>
 #include "../arch/x86_64/limine.h"
 #include "../kernel/ini_parser.h"
@@ -356,7 +357,9 @@ static void dsm_load_stage_range(const ini_config *cfg, int limit_stage, u32 max
                 log_info("[DSM] module not found");
                 log_info(drv->name);
                 if (drv->required && stage->required) {
-                    log_error("[DSM] required module missing, abort stage");
+                    /* 严格错误策略插桩：required 驱动缺模块零降级（DKM-E04） */
+                    panic_full("DKM-E04 REQUIRED DRIVER MODULE MISSING",
+                               "required driver boot module not found in manifest stage", 0);
                     break;
                 }
                 continue;
@@ -368,11 +371,19 @@ static void dsm_load_stage_range(const ini_config *cfg, int limit_stage, u32 max
 
             if (dkm_check_elf64(f->address, f->size) != 0) {
                 log_error("[DSM] ELF check failed");
+                if (drv->required && stage->required) {
+                    panic_full("DKM-E05 REQUIRED DRIVER ELF INVALID",
+                               "required driver boot module failed ELF64 check", 0);
+                }
                 continue;
             }
 
             if (dkm_scan_symbols(f->address, f->size, &symbols) != 0) {
                 log_error("[DSM] symbol scan failed");
+                if (drv->required && stage->required) {
+                    panic_full("DKM-E06 REQUIRED DRIVER SYMBOL SCAN FAILED",
+                               "required driver symbol scan failed", 0);
+                }
                 continue;
             }
 
@@ -380,7 +391,9 @@ static void dsm_load_stage_range(const ini_config *cfg, int limit_stage, u32 max
             if (result != 0) {
                 log_error("[DSM] load failed");
                 if (drv->required && stage->required) {
-                    log_error("[DSM] required driver failed, abort stage");
+                    /* 严格错误策略插桩：required 驱动加载失败零降级（DKM-E07） */
+                    panic_full("DKM-E07 REQUIRED DRIVER LOAD FAILED",
+                               "required driver relocation/load failed", 0);
                     break;
                 }
             } else {

CODE/UTSM/dkm/manifest.d

@@ -0,0 +1,14 @@
+dkm/manifest.o: dkm\manifest.c include\utsm\dkm.h include\utsm\types.h \
+  include\utsm\dma.h include\utsm\block.h include\utsm\net.h \
+  include\utsm\paging.h include\utsm\log.h include\utsm\panic.h \
+  dkm\..\arch\x86_64\limine.h dkm\..\kernel\ini_parser.h
+include\utsm\dkm.h:
+include\utsm\types.h:
+include\utsm\dma.h:
+include\utsm\block.h:
+include\utsm\net.h:
+include\utsm\paging.h:
+include\utsm\log.h:
+include\utsm\panic.h:
+dkm\..\arch\x86_64\limine.h:
+dkm\..\kernel\ini_parser.h:

CODE/UTSM/kernel/main.c

@@ -378,7 +378,10 @@ void kernel_main(void) {
         log_hex64("[SCHED] cfg enable=", (u64)g_sched_enabled_cfg);
         log_hex64("[SCHED] cfg demo_ms=", s_demo_ms);
         if (utsm_sched_bootstrap_init() < 0) {
-            log_warn("[UTSM] scheduler bootstrap failed (non-fatal)");
+            /* SAS-R0 特色自证：调度器 bootstrap 失败 = 单地址空间 O(1)
+             * 调度器没有真正立起来，零降级 panic（SAS-E01） */
+            panic_full("SAS-E01 SCHED BOOTSTRAP FAILED",
+                       "SAS-R0-PCQ scheduler bootstrap failed (was: non-fatal)", 0);
         }
     }